Complaint Form 
FD-71 (Rev. 3-27-95) 


NOTE: Hand print names legibly; handwriting satisfactory for remainder. 
Indices: □ Negative EEJ See below 


Subject's name and aliases 


<(& J 


Character of case 


Complainant I I Protect Source 


Address of Subject 


Complaint received 

ED Personal [xj Telephonic Date 03 /29/1999 Time 6:00PM_ 
Compla inant's address and telephone numb er 

(H) I 

(W) |_|__ , 

Complainant's DOB Sex 


Race 

ED Male 

Height 

Hair 

Build 

Birth date and birth place 

Age 

ED Female 

Weight 

Eyes 

Complexion 

Social Security Number 

Scars, marks and other data 


Employer 


Telephone 


Vehicle Description 
Facts of Complaint _ 

I advised he has been contacted by two reporters, 
one from “Wired Web” (name not provided) and Jim Bruner, “Seattle Times” 
who interviewed and advised t hat the com puter virus “Melissa” is believed 
to have o riginated with him . | has an AOL account for his home 

computer, I I and believes someone hacked into it creating 

a web site"! | | work is that of a l I and he has a 

hobby as a Washington State| | He advised he had nothing 

to do with the virus and is concerned about his reputation because of it. 

He wanted to know if the FBI was working on this case and is e ager to _ 

talk with someone abou t it. He provide d his home telephone as _ 

_and work phone as | 


:erence to a 


Do not write in this space. 


o *7 £ 


Offtl/ior- 77 


SERIALIZED. 


MAR 3 0-199! 


BLOCK STAMP 




















Complaint Form 
FD-71 (Rev. 3-27-95) 


NOTE: Hand print names legibly; handwriting satisfactory for remainder. 
Indices: 0 Negative ED See below 


Subject’s name and aliases 

UNSUB; 

MELISSA VIRUS 


Character of case 

CITA 


Complainant |~~| Protect Source^^z/L^ 


b6 

b7C 


Complaint received/ 

CD Personal j/\X\ Telephonic Date 3/30/ 99- _Time 6 : 3 0 P 


Address of Subject 


Complainant's address and teleph one number 

(Home) 

"(Work) 


Complainant's DOB 


Sex 

F 


Race 

I | Male 

Height 

Hair 

Build 

Birth date and birth place 


Age 

; 

|X1 Female 

Weight 

Eyes 

Complexion 

Social Security Number / 

_ /.i 

/ J 

Scars, marks and other data j 

_\_/ 



o 


Employer 


Address 


Monday-Thursday 6 :3 (la- 5 


b6 

b7C 


b6 

b7C 


Vehicle Description 


Facts of Complaint 

C advised she works in the 
affected w/the Melissa vir 
occurred that may be impo 


JLibrary & one of their computers has been 
C said two suspicious incidents have 


ant, the first about 3/18/99 when she unlocked 
the library be fore it officially opened & found two men inside. One 
individual was I I who previously worked in 

cataloging & the othe: 


him & f 


has advised her he has allowed [ 
£ker, intelligent & into pornography. 


works in the 
to live with 
C went to 


■ j l i ® ^ -. - —* - —-XT--j:- j. - ~ - - 

J who was playing chess on one of the Internet computers, to 

determine how he gained entry & found him defensive & unwilling to leave, 

which he finally did. On Thurs 3/ 25/99, as C was walking toward the _ 

library, she saw anoth er man about [ 


coming out of the library, 
a professor or student & when asked how 
he got into the library said ‘the red ■ 
headed custodian let him in’. He pointed 
to bldgs outside the library & offered 
that he worked in one of them. C does 
not know how these indidivuals are 
gaining access to the library during 
hours when it is locked & thought these 
incidents might be connected to ‘Melissa’. 


This individual is not 


Do not write in this space. 


SAS 


(Complaint received by) 



b3 

b6 

b7C 

b7E 


O ( \0X-bo\n\ 





FD-302 (Rev. 10-6-95) 



- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/01 / 99 


contacted at his place of employment f 


r 


was 


b6 

b7C 


After being advised of the identity of the interviewing 


agents and the nature of the interview, he provided the following 
information: a 

,- L - 

has retained an attorney, I _ 


Jwas"asYed if he wanted hi^Tattorney to 


be present during the i nterview. He replied, "no, it was not 


necessary. 


retained an attorney because of all the 

wanted to discuss the 


publicity surrounding his name, 
case with the Fe deral Burea u of Investigation ( FBI) to attempt to 
clear his name. 



does own the ...account! 


but had nothing to do with the Melissa virus, 
absolutely nothing to hide and wishes to cooperate. 





1 has 


His home address _is[ 





His wife has access to his 


America On-Line (AOL) account and knows the password. Just 


recently, the log-on was set up so that it was not necessary to 
enter the password. His children have access, but only when 
supervised. Occasionally, his children surf the Disney Channel. 
With the exception of his wife's purchases of Beanie Babies and 
books on the Internet, no other purchases have been made over the 
Internet, nor have they shared their password with anyone. They 
use one credit card for the billing of their AOL account and for 
occasional purchases. 


His computer at home is an AST, the model is known as 
Adventure, it originally contained a Pentium 75. Approximately 
one year ago he brought it to CompUSA in | ~| and 

had a chip doubler installed making it 150. It has a modem - 



IWHCYpn 


investigation on 04/01/1999 at Seattle, Washington 

SERIALIZED_ - 


File Date dicta 

ed oAPBlQfe^yS 


SA 1 

by SA MMM: mmm 

FBi-SEATTLE/V , X* _ 



- ' m _ 



This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


b6 

b7C 


b3 

hS 

hlC 

b7E 






£ 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of 


, On 04/ 01/ 1999 , Page 


b3 

b6 

b7C 

b7E 


is comfortable using 


14.4 megahertz and 16 megabits of random access memory( RAM). 
contains the Windows 95 Office S uite softwa re package, 
still has the original package. 

Word and Excel. 


1 currently works for 


It 



b6 

b7C 


e-mail account with his employer,[ 


J has another 
His e-mail 


account at work is used predominantly for inter-office purposes. 
There have been a few times when he has sent his wif e quick e- 
mails regarding dinner and after school activities. I I 

has never accessed either his AOL account or his account at work 
remotely. He added, he did not think he could access his 
accounts remotely. 


uses his AOL account solely for sending e- 
mails and surfing the Web. He does not visit any pornographic 
sites and has never participated in Internet Relay Chat (IRC). 

The account is still active, and he h as not changed the password. 

" — — ]plans on canc eling his A OL 

does 


b6 

b7C 


The password is 

account as soon as the investigation is complete, 
not currently have/nor did he ever create a website. He 
attempted to create a websit e or homepa ge awhile back, but his 
attempts were unsuccessful. I I has not participated in 

on-line Newsgroups. He had particular interest in the Newsgroup 

but was 


] deletes any junk 


unable to figure out how to sign on. | ~ 

mail that he receives. He occasion ally receives pieces of mail 
that he cannot discern. | referenced "alt" as being 

attached to some incoming e-mails. He believes it is typical to 
receive junk mail . He receives junk mail predominantly at his 

account. 








1 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of 


, On 04/01/1999 , Page 


In assessing his computer proficiency, 
admitted knowing th e "basics." He declared himself to be a 
novice. I I work s in Word and Excel, but does not know how 

to program! | | took college courses in BASIC and Fortran 

computer languages. He employs a computer aided tool known as 
AutoCAD at work to help him draft engineering plans. It is self- 
contained software and requi res no prog ramming on his part. He 
compared it to Correl Draw. I ~Tobtained an Associates 

Degree in from]_ 

I | commented that the fact that someone broke 

into his AOL account and used his name to send this virus out was 
very distressing. His company was victimized by the virus as 
well. System engineers of his company worked to resolve the 
problem for hours on Friday, March 26, 1999. 

_A chronology of events was described as follows: 

| first heard of his AOL address being tied to the virus 
on March 29, 1999 at approximately 10:00 a.m. Pol ly Sprenger of 
Wired News called him to inquire about the "hack." | | was 

shocked and cannot recall much of the conversation. He recalled 
hearing about the Melissa virus while driving to Idaho. He went 
to Idaho to visit a friend for the weekend. After thinking about 
the phone call, he was bothered by the fact that Sprenger had 
obtained his home phone number . He reali zed his information was 
most likely all over the Web. | [ maintained someone else 

made it look like the virus originated from him but that he had 
nothing to do with it and was not responsible for it. 

I ~l the n contacted AOL via e-mail and stated that 

he is_ but that he did not create or distribute 

the Melissa virus. AOL sent back an e-mail explaining how to 
remove the virus. He sent back a reply stating again that he was 
not responsible for the virus and wanted to know how to go about 
clearing his name. He was then referred to AO L'’s legal g roup, 

where he was told it was under investigation. _ believes 

he h as copies of the e-mails and will forward to Special Agent 
(SA) | I Upon arriving home on Monday at approximately 6:00 

p.m., he saw the news media on his front lawn. He then realized 
it was serious. He became very concerned and worried on how he 








I 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of 


.♦ On 04/01/1999 , Page 


could prove he had nothing to do with it. _immediately 

contacted the FBI at approximately 6:30 p.m. to lodge a 
complaint. He then called Channel 4 at approximately 7:00 p.m. 
to get his name out there and proclaim he had nothing to do with 
it. Channel 4 came to his home at approximately 8:00 p.m. and 
interviewed him. ZD.net contacted him and told him it looked 
similar to a virus which occurred in 1997. He continues to be 
contacted by the media. He recently was asked to fly to New York 
to appear on Good Morning America. He has not yet decided if he 
will go. 

I normally r eceives two e-mails on average a 
day with his | 1 account. He is currently receiving 

hundreds of e-mails, some congratulating him, others attacking 
and threat ening him, and some other probing for information. 

| has had his AOL acc ount since late 1995 or early 19 96. 
At the time he was working at| | 


| He never noticed anything 

unusual in regard to his account other than the junk mail 
mentioned earlier. 


I I does not know anyone who would do this to 

him. He c ould not reference anyone who would be angered at him. 

| | never gave out his password. The only person with 

knowledge of his password is his wife. He brought his computer 
to COMPUSA in | ~| Washington twice, early 1997 and 

about one year ago to install the chip doubler. He also had it 
serviced at Ballard Computer, | Washington once in 1996 

for an upgrade of some sort. He cannot recall the specific 
dates, names of the employees who service d his machine , or 
specifi cs of what he had done. I 1 has a friend, | 1 

1 who serviced his computer several times for reasons such 
as: reconfiguring Windows and various games because of 
incompatibili ty issue s, chang ing the resolu tion, and adjusting 
the speak er. | works at | | a computer graphics 

company. | | also contacted AOL service representatives 

over the telephone to walk him through the installation of the 
AOL Internet software. 









Continuation of FD-302 of 


, On 04/01 /1999 , Page 


| remarked he is willing to assist the FBI in 
any way possible. He was asked to keep the interview 
confidential, but that he could certainly discuss it with his 
attorney. When asked if he would be willing to submit to a 
polygraph examination, he replied, yes, he would in order to 
prove that he is telling the truth." 






* *% 

FD-320 (Rev. 4-11-86) 




In Reply, Please Refer to 
File No. | 


b3 

b7E 


FBI CASE STATUS FORM 


Date: 03/01/2000 


To: TT. S. Attompy Katrina Pf 1 anmpr £01 _ ITS A TTrrinn St _ Spattl e, _WA 

~ (Name and Address of USA) 

From: SAC Charles E. Mandicro _ _ 

(Name of Official in Charge and Fie 1 eft) iv is ion) (Signature of Official in Charge) 


RE: 


(Name of Subject) 


(Age) 


(Sex) 


b6 

b7C 


You are hereby advised of action authorized by AUSA 


lvalue ui uon uf 


AUSA) 


on information submitted by Special Agent SA I 

1 -(NameJ 


on 03/01/2000 • 
(Date) 


(Check One) 

□ Request further investigation 
[y] Immediate declination 
I | Filing of complaint 
I | Presentation to Federal Grand Jury 
I | Filing of information 
I | Other 

For violation of Title 18 _, USC 5 Section(s)_ 103 0 


Synopsis of case: 

Subject David Smith was arrested on 4/1/99 by New Jersey 
State Police, pursuant to a state of New Jersey arrest warrant. 
Smith was charged with second degree offenses of interruption of 
public communication, conspiracy to commit the offense, third 
degree theft of computer service, and third degree damage or 
wrongful access to computer systems realting to the propagation 
of the computer virus known as "Melissa". Smith hiiacked the AOL 

- ] 


b6 

b7C 


[ 


account, 


of Washington state resident 


J was cleared early in the investigation and 

AUSA I 


cooperated fully with the Seattle Division _ 

| | Seattle, declined prosecution on this matter since 

subject Smith is being prosecuted by^t-ate and federal 
authorities in New Jersey. 






plead guilty in December-19 99. 


iC 


061mmm03.320 


1 - Addressee 

1 - AUSA l ~ 

2 - Seattle |_ 
MMM/mmm 

(4) 


(SA 
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FD-542 (Rev. 11-02-1999) 


FEDERAL BUREAU OF INVESTIGATION 


Precedences ROUTINE Dates 03/20/2001 

Tos Seattle 


Proms Seattle 

Squad 11 

Contacts 


Approved B 


fit 


Drafted Bys 
Case ID #s 


ljs 


(Closed) 

(Pending) 


b3 

b6 

b7C 

b7E 


Titles UNSUBS 

MELISSA VIRUS 
I I - VICTIM 

Synopsiss To claim appropriate accomplishment statistics. 

Details s This communication serves to document accomplishments 
associated with the above captioned case that were captured from 
3/31/1999 to 3/3/2000. 





Ct x 


To: 
Re: 


Seattle 


Fro! 


Seattle 

03/20/2001 


b3 

b7E 


Accomplishment Information: 


Number: 1 

Type: NIPCIP COMPROMISED SITE IDENTIFIED AND NOTIFIED 

ITU: NIPCIP 

Claimed By:_ 

SSN: 

Name: 

Squad: Squad 11 


Number: 1 

Type: NIPCIP VICTIM CONTACTED/INTERVIEWED 

ITU: NIPCIP 


Claimed By 
SSN: 
Name: 
Squad 


• squad ii 


b6 

b7C 


Number: 1 

Type: NIPCIP SUBJECT TOOL/EXPLOIT/MALICIOUS CODE IDENTIFIED 

ITU: NIPCIP 

Claimed By: p 
SSN: 

Name: 

Squad:' squaa T1 


0791j S05.542 

♦♦ 


2 
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# • 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/23/2002 

To: Seattle 


Prom: Seattle 



Title: UNSUB; 

MELISSA VIRUS; 
Computer Intrusion 


Synopsis: To claim appropriate accomplishment statistics. 

Details: This communication serves to document the 
accomplishment associated with captioned case. 


b3 

b6 

b7C 

b7E 



SEARCHED—-INDEXED- 

SERIALIZED_—FILED- 

SEP 2 8 2002 

FBI SEATTLE 

:”z ±z±OT-l 


b3 

b7E 








TO: 
Re : 


Seattle Froi 




Seattle 

09/23/2002 



b3 

b7E 


Accomplishment Information: 

Number: 1 

Type: NIPCIP VICTIM CONTACTED/INTERVIEWED 

ITU: AGENT INTERVIEW 

Claimed By: 

SSN: I 
Name: 

Squad: squad ll 


b6 

b7C 


♦♦ 

266mmm06.542 


2 








